Port 1025

  • Thread starter Thread starter Bill Bradshaw
  • Start date Start date
B

Bill Bradshaw

I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Does anybody have any idea why even though I have my internal modem
disconnected
netstat -an would report port 1025 as being open?
 
I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:
Active Connections
Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING
Click to expand...

Doing a google search on "port 1025 tcp listening microsoft"
shows there are quite a few trojans that can use port 1025.

If this is a w2k system, it also appears mstask.exe can
listen on this port.

Try killing the mstask process, and running the netstat again,
to see if it closes the port.

Regards, Dave Hodgins
 
==> *Bill Bradshaw* from: (e-mail address removed)
==> scribbled in: [email protected]
I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Does anybody have any idea why even though I have my internal modem
disconnected
netstat -an would report port 1025 as being open?
Click to expand...

Hi,
Download and install freeware TCPView from sysinternals and it should show
wich service or program is listening on port 1025.
http://www.sysinternals.com/ntw2k/source/tcpview.shtml
hth
 
Generally speaking, ports above 1023 are dynamically assigned. You will find
that some service (NT/2000/XP) is using that port when it is activated. In
order to get rid of that port, you must shut down the service that it is
supporting (removing the modem doesn't do that). With a little work, you can
reduce the open ports to:

Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 192.168.1.6:139 0.0.0.0:0 LISTENING
UDP 192.168.1.6:137 *:*
UDP 192.168.1.6:138 *:*

For further info, see: http://www.yellowhead.com/xpcfg1.htm
****************** REPLY SEPARATER *********************
 
Generally speaking, ports above 1023 are dynamically assigned. You will find
that some service (NT/2000/XP) is using that port when it is activated. In
order to get rid of that port, you must shut down the service that it is
supporting (removing the modem doesn't do that). With a little work, you can
reduce the open ports to:

Active Connections
Proto Local Address Foreign Address State
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
TCP 192.168.1.6:139 0.0.0.0:0 LISTENING
UDP 192.168.1.6:137 *:*
UDP 192.168.1.6:138 *:*
Click to expand...

John, based on his posts in a recent different thread, the OP uses Win
98SE on a stand alone PC. He's already closed port 139 and his netstat
-an result only shows his proxy on 8080 plus the mysterious loopback
(I guess it is) on 1025. The question (I'm pretty sure) is what
service or program might be causing his port 1025 result.
For further info, see: http://www.yellowhead.com/xpcfg1.htm
****************** REPLY SEPARATER *********************
Click to expand...

Art
http://www.epix.net/~artnpeg
 
No. Actually I went into task manager and started shutting down programs.
The Symantec common client program ccapp.exe is the culprit. I have not had
time to search the web to try and find an answer as to why this program is
supposedly listening on port 1025. As was pointed out when I first connect
through DUN the only ports that show up in netstat -an are 1025 and 8080
(Webwasher).
 
No. Actually I went into task manager and started shutting down programs.
The Symantec common client program ccapp.exe is the culprit.
Click to expand...

I don't use NAV but I would guess then that it has to do with NAV's
auto-updating functionality. Now that you know what it is, you can
ignore it just as you should ignore your netstat result concerning
your proxy. They are harmless.






Art
http://www.epix.net/~artnpeg
 
The Symantec common client program ccapp.exe is the culprit. I have not had
time to search the web to try and find an answer as to why this program is
supposedly listening on port 1025.
Click to expand...

I cut and pasted this this from a Symantec web site since the url was
too long. Just Google up ccapp.exe to find the page:
******************************************************************************
ccApp is an important part of the protection that Norton AntiVirus
(NAV) or Norton Internet Security (NIS) provides and should not be
disabled at startup.

ccApp.exe is the common hosting application that is used by both NAV
and NIS. It is responsible for calling the different program features
in NAV and NIS. For example, in NAV, if Auto-Protect and Email
Scanning are enabled, then ccApp.exe makes sure that those programs
are running. If ccApp is disabled, then Auto-Protect and Email
Scanning will not run.
***********************************************************************

Art
http://www.epix.net/~artnpeg
 
I connect to the internet over a dialup connection. When I am completely
disconnected and run netstat -an I get the following:

Active Connections

Proto Local Address Foreign Address State
TCP 127.0.0.1:1025 0.0.0.0:0 LISTENING

Does anybody have any idea why even though I have my internal modem
disconnected
netstat -an would report port 1025 as being open?
--
<Bill>

Brought to you from beautiful Unalaska/Dutch Harbor, Alaska.
N 53° 51.140' W 166° 30.228' (WGS 84)
Click to expand...

You have a AntiVirus program? Most likely it interfacing on the TCP/IP
stack for mail. Nav as I used to use it listend on ports 1025-1027
 
Back
Top